How SaaSCoreX works under the hood

export async function requireOrg() {
  const session = await requireAuth();
  if (!session.activeOrgId) {
    throw new Error(
      "Session has no activeOrgId."
    );
  }
  return session;
}

// Every query is scoped to the active org
const projects = await db.project.findMany({
  where: { orgId: session.activeOrgId },
});

export type AuditAction =
  | "user.login"    | "user.logout"    | "user.delete"
  | "user.update"
  | "org.create"    | "org.update"     | "org.delete"
  | "member.invite" | "member.accept_invite"
  | "member.revoke_invite" | "member.change_role"
  | "member.remove" | "member.leave"
  | "billing.checkout"
  | "billing.subscription_created"
  | "billing.subscription_updated"
  | "billing.subscription_cancelled"
  | "billing.payment_failed"
  | "admin.impersonate" | "admin.user_update"
  | "resource.create" | "resource.update" | "resource.delete"
  | "resource.read" | "user.sessions_invalidated";

export async function audit(input: AuditLogInput): Promise<void> {
  if (!isFeatureEnabled("auditLog")) return;

  try {
    await db.auditLog.create({
      data: {
        actorId: input.actorId ?? null,
        orgId: input.orgId ?? null,
        action: input.action,
        targetType: input.targetType ?? null,
        targetId: input.targetId ?? null,
        meta: input.meta ?? undefined,
        ipAddress: input.ipAddress ?? null,
        userAgent: input.userAgent ?? null,
      },
    });
  } catch {
    // Never throws — audit failures don't disrupt the primary flow
  }
}

function generateKey() {
  const plaintext = `sk_${randomBytes(32).toString("hex")}`;
  const prefix = plaintext.slice(0, 11); // "sk_" + first 8 hex
  const keyHash = createHash("sha256")
    .update(plaintext).digest("hex");
  return { plaintext, prefix, keyHash };
}

export async function createApiKey(orgId, userId, name) {
  const { plaintext, prefix, keyHash } = generateKey();

  const record = await db.apiKey.create({
    data: { orgId, userId, name, keyHash, prefix },
  });

  // plaintext shown once — never stored
  return { key: plaintext, record };
}

export async function validateApiKey(plaintext) {
  const keyHash = hashKey(plaintext);
  const key = await db.apiKey.findUnique({
    where: { keyHash },
  });
  if (!key || key.revokedAt) return null;
  if (key.expiresAt && key.expiresAt < new Date()) return null;
  return { userId: key.userId, orgId: key.orgId };
}

export async function processWebhookEvent(
  event: Stripe.Event
): Promise<void> {
  // Idempotency: deduplicate by stripeEventId
  const existing = await db.webhookEvent.findUnique({
    where: { stripeEventId: event.id },
  });
  if (existing?.status === "PROCESSED") return;
  if (existing?.status === "PROCESSING") return;

  // Claim the event: RECEIVED → PROCESSING
  const webhookEvent = await db.webhookEvent.upsert({
    where: { stripeEventId: event.id },
    create: { stripeEventId: event.id, status: "PROCESSING", ... },
    update: { status: "PROCESSING", attempts: { increment: 1 } },
  });

  try {
    await handleEvent(event);
    // PROCESSING → PROCESSED
    await db.webhookEvent.update({
      where: { id: webhookEvent.id },
      data: { status: "PROCESSED", processedAt: new Date() },
    });
  } catch (error) {
    // PROCESSING → FAILED (retryable)
    await db.webhookEvent.update({
      where: { id: webhookEvent.id },
      data: { status: "FAILED", error: error.message },
    });
    throw error; // Return 500 for Stripe retry
  }
}

// Consistent response envelope
type ApiResponse<T> =
  | { data: T }
  | { error: { code: ErrorCode; message: string; requestId: string } };

// Every route follows the same pattern:
export async function GET(request: Request) {
  const auth = await authenticateRequest(request);     // 1. Authenticate
  requirePermission(auth.role, "member.list");         // 2. Authorize
  await requireRateLimit(`api:${auth.orgId}`, api);    // 3. Rate limit

  const members = await listMembers(auth.orgId, {      // 4. Org-scoped query
    page, pageSize
  });

  return json({                                        // 5. Envelope response
    data: { items: members, meta: { page, pageSize, total, totalPages } }
  }, { headers: { ...corsHeaders(request), "X-Request-Id": getRequestId() } });
}

// Centralized typed error → HTTP response mapping
export function mapErrorToResponse(request, error) {
  if (error instanceof NotFoundError)       return fail(request, "NOT_FOUND", 404);
  if (error instanceof ValidationError)     return fail(request, "VALIDATION_FAILED", 422);
  if (error instanceof ConflictError)       return fail(request, "CONFLICT", 409);
  if (error instanceof BillingStateError)   return fail(request, "BAD_REQUEST", 400);
  if (error instanceof LimitExceededError)  return fail(request, "LIMIT_EXCEEDED", 403);
  return null; // Unknown error — caller re-throws
}